Suspicious Removal of Kubernetes Events (via application)

title: Suspicious Removal of Kubernetes Events (via application)
id: e6a6ea2f-b537-5445-bb82-7f3a84eac751
status: stable
description: This rule detects when events are deleted in Kubernetes. An adversary may delete Kubernetes events seeking to evade detection.
references:
    - https://attack.mitre.org/techniques/T1070/
    - https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Delete%20K8S%20events/
author: Huntrule Team
date: 2026-05-25
tags:
    - attack.stealth
    - attack.t1070
logsource:
    category: application
    product: kubernetes
    service: audit
detection:
    selection:
        verb: 'delete'
        objectRef.resource: 'events'
    condition: selection
falsepositives:
    - Unknown
level: medium